This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid

Synchrony in Networked Microgrids under Attacks

Shankar Abhinav, Graduate Student Member, IEEE, Hamidreza Modares, Member, IEEE
Frank L. Lewis, Life Fellow, IEEE, Frank Ferrese, Senior Member, IEEE, and Ali Davoudi, Senior Member, IEEE

AbstractThis paper proposes attack-resilient distributed con-

trol for synchronization of islanded, networked, inverter-based
Attack
microgrids. Existing cooperative control techniques are suscepti-
ble to attacks and cannot guarantee synchronization. The effect
of attacks on sensor/actuator, communication links, and hijack-
ing controllers is studied. A resilient synchronization protocol
is presented to address sensors/actuators attacks. Attacks on
communication links and adverse effects of hijacking controllers
are also mitigated by designing a trust-based control protocol.
The efficacy of the proposed solutions is evaluated for a modified
IEEE 34-bus feeder system under different types of attack.
Index TermsAC microgrids, cooperative control, distributed
control, attack, secondary control.

I. I NTRODUCTION
Distributed cooperative control of islanded AC microgrids,
that uses a sparse communication network to exchange in-
formation among inverters as seen in Fig. 1, has recently
emerged as a superior alternative to central control struc-
tures in microgrids [1][5]. Central controllers have a fully-
connected, bidirectional, one-to-all communication network
where the central control entity collect information from all
agents, process the information centrally, and broadcast the
control commands to all agents. Therefore, it features global
situational awareness. This feature is missing in distributed
control settings, where a sparse communication network limits
node-to-node information propagation. Distributed controllers
consists of local controllers with access to local data and par-
tial neighbor data, which makes them vulnerable to malicious
attacks. A malicious entity might corrupt the data exchanged
by attacking the node, communication link, or hijacking the
entire node. On the other hand, central controllers expose
a single point-of-failure, which is a reliability bottleneck.
Central controllers also require a complex and fully-connected
communication network, while distributed control systems
are more reliable, scalable, and flexible. The drawback of
distributed control paradigms, vulnerability to cyber-attacks,
is addressed in this paper.
The high-volume integration of power electronic devices
in microgrids, that leverage advanced software-intensive con-
trollers and communication networks, makes them vulnerable
This material is based upon research supported in part by the U.S. Office
of Naval Research under award numbers N00014-14-1-0718 and N00014-17-
1-2239, and by the National Science Foundation under Grant ECCS-1405173.
S. Abhinav, F. Lewis, and A. Davoudi are with Electrical Engineering
Department, the University of Texas at Arlington, TX 76019 USA (e-mail:
{shankar.abhinav, lewis, davoudi}@uta.edu).
H. Modares is with the Department of Electrical and Computer Engineering,
Missouri University of Science and Technology, Missouri, MO 19112 USA
(e-mail: modaresh@mst.edu).
F. Ferrese is with the Naval Surface Warfare Center, Philadelphia, PA 19112
USA (e-mail: frank.ferrese@navy.mil).
Fig. 1. A networked AC microgrid under attack: a) Controller compromised;
b) Attack on sensors; c) Attack on communication links.
to future cyber attacks. Massive adaptation of computation,
communication, and control will make power electronics-
intensive microgrids analogous to robotic, autonomous vehi-
cle, and other cyber-physical systems that are currently subject
to cyber attacks. As predecessors to microgrids, legacy power
grids with advanced communication and control have already
been a subject of security vulnerability. Maroochy malicious
breach of supervisory control and data acquisition [6], SQL
slammer worm attack on the Davis Besse nuclear plant, and
StuxNET computer worm attack on a nuclear enrichment
facility [7], exemplifying the vulnerability of cyber-physical
systems.
Corrupt data can disrupt inverters synchrony and lead
to a network-wide instability. The bulk of existing research
has been focused on attack detection in power systems [8]
[13]. Synergistically, mitigation techniques shall prevent the
attacker from propagating its adverse effects throughout the
microgrid. In a false-data injection attack, disturbances are
injected to the sensors and/or actuators of agents to disrupt
their transmitted data. While one could identify and remove
misbehaving agents, [8], [9], this would require knowledge
of the communication network, and such solutions can be
difficult to scale. Computationally-efficient techniques [14]
detect deception attacks on the sensors, but do not mitigate
their adverse effects. Robust game-theoretic solutions [15],
[16] lead to conservative results against sophisticated attacks.
[17] designs an output-feedback law despite attacks on sensors,
given the full knowledge of network topology. The cooperative
economic dispatch in [18] uses an additional communication
network to observe the original networks behavior.
An attack can be modeled similar to noise/disturbance,
whose intent could be to destabilize the system. There exist
noise filtration techniques [19] and disturbance attenuation

1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid

methods [20] for multi-agent systems. Noise filtration tech- The graph Laplacian matrix, L D A, includes
niques [21] usually assume certain statistical properties, e.g., distributed system dynamics, e.g., the convergence rate. A
they mostly assume a white Gaussian noise signal with zero path from node i to node j is a sequence of edges
mean and finite variance. This is not valid for the case of an at- poi , ok q, pok , ol q, ..., pom , oj q. A graph is said to have a span-
tack that can be deliberately designed. Disturbance attenuation ning tree, if there is a root node with a path from that node
techniques aim to minimize the effect of the disturbance on the to every other node in the graph. In that case, the Laplacian
local neighborhood tracking error. However, in the presence matrix eigenvalue 1 0 is a simple eigenvalue [22]. The
of a stealthy attack, which is considered as a constant signal solution to L 0 can be written as c1, where c is a
in this paper, the attacker can deceive the agents by assuring constant. Thus, synchronization is guaranteed as long as the
that their local neighborhood tracking error is zero even in communication graph has a spanning tree.
the presence of the attack. Such attacks cannot be detected A leader node can be connected to some nodes (at least to
or mitigated using existing disturbance attenuation or noise one root node) by unidirectional edges. The nodes connected
filtering techniques. to the leader node and the corresponding connecting edges are
In this paper, resilient distributed protocols for secondary called pinned nodes and pinning edges, respectively. A gain
cooperative control of islanded AC microgrids under attacks is assigned to each pinning edge, e.g., gi is the pinning gain
are studied. The vulnerability of existing distributed con- from the leader to the node i. The pinning gain is zero for an
trollers, in the presence of attacks on sensor/actuator, con- unpinned node. The pinning gain matrix is G diagtgi u.
trollers, and communication links, is evaluated. To address
sensor/actuator attacks, a distributed observer-based frame-
III. C OOPERATIVE C ONTROL OF AC M ICROGRIDS
work is presented. To mitigate attacks on communication links
and hijacking of controllers, a trust/confidence-based control A. Dynamics of the Physical Microgrid
protocol is designed. Each inverter monitors the information
The inverter model consists of a DC power source, inverter
it receives from its neighbors, updates its local confidence
bridge, power sharing controller, output filter, and voltage and
factor, and sends to its neighbors. Each inverter also updates
current controllers. Dynamics of each inverter are formulated
trust factors for all its neighboring inverters (assigned to each
in its own direct-quadrature (d-q) reference frame. The ref-
incoming communication link). Data received at each inverter
erence frame of one inverter is considered as the common
from neighbors is plugged in the distributed observer-based
reference frame. The power controller dynamics are
frequency update law, weighted by its trust factor for each
neighbor and the neighbors confidence factor. The inverters $ dP
i
ci Pi ` ci pvodi iodi ` voqi ioqi q
in close proximity to the attack source will have smaller &
dt , (1)
confidence factor and, therefore, slow down the rate at which % dQi Q ` pv i v i q

the corrupted data from compromised inverter spreads. This ci i ci oqi odi odi oqi
dt
allows neighbors of the compromised inverter to assign smaller
trust factors for their compromised neighbors and, therefore, where vodi and voqi are the direct and quadrature components
eventually discards the information received, once the trust of the output voltage of inverter i, while iodi and iodi are
value drops below a threshold. Connectivity conditions re- the corresponding current terms. Pi and Qi are the active
quired to ensure inverters synchrony are explored. and reactive powers measured at inverter i. ci is the cut-off
This paper is organized as follows: Section II provides frequency of the low-pass filter used to measure power.
preliminaries of graph theory. Conventional distributed coop- The large-signal dynamical model of an inverter, with
erative control is presented in Section III. In Section IV, attack internal control loops, is adopted from [23]
modeling and vulnerability of the conventional cooperative $
& dxi f px q ` gpx qu
control are discussed. Section V presents the attack-resilient dt
i i i i
, (2)
distributed cooperative control. Case studies, using a 34-bus %
yi hi pxi q
IEEE feeder network with six inverters, are presented in
Section VI. The conclusion is drawn in Section VII. where the state vector is

II. P RELIMINARY OF G RAPH T HEORY xi ri , Pi , Qi , di , qi , di , qi , ildi , ilqi , vodi , voqi , iodi , ioqi s .
The communication network among inverters is represented (3)
by a graph Gr pO, Eq, as shown in Fig. 1(b). O The inductive load dynamics are modeled as
to1 , o2 , ..., on u is a set of n nodes or vertices corresponding
to each inverter. E is a set of edges or arcs, where each $
diload,d
& R
Lload iload,d ` iload,q `
load 1
Lload vbd
edge from oi to oj is denoted by poi , oj q, and indicates the dt
. (4)
information flow between inverters i and j. Ni is the set of diload,q
%
dt R
Lload iload,q iload,d `
load 1
Lload vbq
inverters providing information to inverter i, also referred to as
its neighbors. The graph can be represented by an adjacency Detailed expressions for (2)-(4), and inverter parameters,
matrix A raij s, with weights aij 0 if poi , oj qE, can be found in [23]. Assuming inductive lines, the active and
otherwise aij 0. The diagonal in-degree matrix is defined reactive power injections at bus i of the power distribution
as D diagtNi u. network, due to inverter i, is given by

1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
$ IV. ATTACK M ODELING AND C ONTROL V ULNERABILITY
vmag,i vbus,i sinpi i q
& Pi Zi
% Q vmag,i vbus,i cospi i q
i Zi
Zi is the combined impedance of the output filter and the
connector. vmag,i =i is the inverter i output voltage, and
vbus,i =i is the voltage at bus i. Simplifying (5) leads to
linear droop relationships for pPi , i q and pQi , vi q.
B. Primary Droop Controller
Decentralized droop techniques are conventionally adopted
for the primary control of AC microgrids by linearizing the
relationships for pPi , i q and pQi , vi q in (5),
"
i ni mpi Pi
. (6)
vmag,i Vni nqi Qi
vmag,i and i are the reference voltage and frequency,
respectively, provided for the internal control loops. Pi and
Qi are the inverters active and reactive powers. mpi and nqi
are the droop coefficients evaluated based on the inverters
ratings. ni and Vni are the set points for the primary control
in (6), and are set by the secondary controller.
C. Cooperative Secondary Controller
Droop control techniques lead to a deviation of voltage
and frequency from their reference set points. The secondary
control provides ni and Vni in (6) to synchronize the invert-
ers voltages and frequencies to their reference values. This
can be achieved by each inverter exchanging data only with
its neighbors on the communication graph. Differentiating (6)
gives the dynamics to obtain the control input ni ,
9 i 9 ni mpi P9i .
The auxiliary control input, ui , is then set as
9 i ui .
The cooperative frequency control law, based on the frequency
information of neighbor inverters and the leader node, is
ei ptq aij pi ptq j ptqq ` gi pi ptq ref q . (9)
jPNi
i and j are the frequencies of inverters i and j. Ni is the
set of inverters neighboring inverter i on the communication
graph. The pining gain, gi , is non-zero for the inverters
connected to the reference frequency, ref .
The auxiliary control ui is given by
ui ptq c ei ptq.
where c P R is a coupling gain. The secondary control set
point, ni , is then given by
ni ui ` mpi P9i dt. (11)
where P9i is given by (1). A similar procedure by the authors
has led to a cooperative secondary voltage control [24].
Moreover, [25][28] have studied the effect of communication
delay on distributed secondary control of AC microgrids.
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Smart Grid
2 . (5) A. Attack Models
vbus,i
Zi The two types of attacks, in general, include attacks on
controller and attacks on communication links [8], [9], [29].
[30], [31] proved that an attacker only needs to obtain local
information to launch a stealth attack. Bad data detection
techniques can check the validity of the received data, but
they are usually applied in a centralized manner. Distributed
control of islanded AC microgrids makes them more prone to
attacks that can inherently become stealth given the limited
communication among inverters.
Assumption 1. Attack signal is considered to be constant.
Moreover, the attacker does not send on/off commands to the
actuators.
We consider a sophisticated form of attack when the attacker
has knowledge of the system and can hijack controllers/corrupt
communication links. The attack signal can be an arbitrary
signal (not constant) or a constant one. For attack signals that
are arbitrary in nature, the local neighborhood tracking error
will not go to zero, and the signal can be treated as corrupted
with noise. Noise filtration techniques [19] can address such
an attack; e.g., the authors have previously addressed noise-
resilient synchrony of AC microgrids [21]. The attack of a
constant corrupted signal is more complicated, and is consid-
ered here. Controller attacks either inject a disturbance into
actuators/sensors or hijack the entire controller. However, in
this paper it is assumed that attacker does not any send on/off
command to the actuators. If an actuator is fully turned off,
there would be no control-theoretic solution, as there is no
instrument to implement the control command. The attack on
actuators, that drive the control input, can be modeled [8], [9]
by
(7) uci ui ` i uai . (12)
uai is the disturbance injected into the actuator i and uci is the
(8) corrupted control input. ui is the control input in (10). 1
represents the presence of attack (in which case uci ui ` uai )
and 0 represents absence of attack (in which case uci
ui ).
If the entire controller is hijacked, then the attacker can
corrupt the inverters frequency. This is modeled by
ic i ` i ia . (13)
ia is the disturbance signal injected into the controller i and
ic is the corrupted inverter frequency. i 1 indicates the
presence of an attack.
(10) If the communication link between two inverters is compro-
mised (e.g., with false-data injection), the controller receives
corrupted frequency information. For example, false data in-
jection [30], [31] can corrupt the frequency information. The
deception attack on communication links can be modeled by
ij i ` i ia . (14)
where ia is the disturbance signal injected into the controller i,
and ij is the frequency of inverter i communicated to inverter
j. i 1 indicates the presence of an attack.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid

B. Vulnerability of the Cooperative Control to Attacks

Theorem 1: Consider the standard synchronization protocol
(9) under attack. The synchronization error is nonzero for an Trust

Neighbors Data
intact inverter, if it is reachable from a disrupted inverter. Factor
Distributed
Proof: Define a rp1a qT , p2a qT ...pN a T T
q s and ua Confidence
Observer
rpua1 qT , pua2 qT ...puaN qT sT as the vectors injected to sensors and Factor
actuators, respectively. Using the control protocol (8), (10),

Cyber Layer
and disturbances (12)-(14), the global synchronization error Secondary Frequency Control
dynamics, under attack, become Secondary Voltage Control

e9 c pL ` Gqe . (15)
Inv i
Define pL ` Gqea ` u, where diagpi q, and
diagpi q. i 1 and i 1 indicate the presence of
attack in inverter frequency and control input respectively. The Inv 1
solution to (15) is
Inv 2
Communication Graph
t
e ptq ec pL`Gqt e p0q ` ec pL`Gqpt q d. (16) LC Filter Output Connector
0

Energy
Source
Since pL ` Gq is positive-definite, and c is a positive
constant,
8 the first term goes to zero. Then, using eAt
m
m1 pAtq , one has Physical Layer
Primary Controller

8 t
m
e ptq pc pL ` Gqpt qq d. (17)
LC Filter Output Connector
m1 0
Energy
Source

m
If m 0 is the first integer, such that lij rpL`Gqm sij is
nonzero, then the node i is reachable from the node j, and m is
the length of the shortest directed path from j to i. Therefore,
if the inverter i is reachable from the disrupted inverter j, then Primary Controller
m
lij 0 for some 0 m N 1 making the synchronization
error for inverter i non-zero. This completes the proof.  Fig. 2. Observer-based controller with trust and confidence factors.

V. ATTACK - RESILIENT C OOPERATIVE C ONTROL

A. Observer-based Cooperative Control
Conventional cooperative control is vulnerable to attacks
due to the absence of a central controller to monitor global
activities. An attack on a single inverter can propagate across
the network, and affect the fidelity of information used in the
cooperative control law. Instead of using neighbors informa-
tion, one can use a distributed observer to track the reference
frequency set point, and the attack effect can be restricted to
the inverter under attack. The secondary frequency control can
then be achieved by using the inverters local frequency and its
local estimation of the reference set point, using a distributed
observer that tracks the leader nodes information. The control
input (10) is modified into
ui ptq c pi ptq i ptqq .
c P R is a coupling gain. i is the frequency observed at
inverter i given by
9 i ptq aij pi ptq j ptqq ` gi pi ptq ref q . (19)
modeled by (12) only effects the local frequency. Due to
the separation between the communication network and the
inverter local frequency, the attack is limited to the inflicted
inverter and does not spread across the communication net-
work in contrast to the conventional cooperative control.
The network of inverters has only one legitimate leader.
However, if the controller of inverter i is hijacked, this inverter
can be considered as an illegitimate leader that might access
a subset of inverters, depending on the communication graph
topology and the inverter position in graph. Since the only
information exchanged is the observers output, the compro-
mised inverter acts as an illegitimate leader with its own ob-
server, regardless of neighbors, to disrupt the synchronization
process. The compromised inverter adds a constant to the
(18) original observer output. Consider the proposed observer (19),
and define
ei ptq aij pi ptq j ptqq ` gi pi ptq ref q . (20)
jPNi

jPNi as the local neighborhood tracking error for inverter i.

where j is the observed frequency at inverter j. Theorem 2: Let the controllers of a subset of inverters be
The secondary control set point, ni , is given by (11). From entirely compromised. Then, the inverters observer output is
(18) and (19), it can be seen that attack on actuator/sensor a constant, and a convex combination of the legitimate and

1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
illegitimate leaders state. Moreover, the local neighborhood
tracking error (20) goes to zero for an intact inverter.
Proof: A leader-follower network with a single leader under
attack with constant frequency output signal can be considered
as a network of inverters with one legitimate leader and
some illegitimate ones (compromised inverters). It is shown
in the containment problem in [32] that the agents outputs
synchronize to a convex combination of the outputs of all
leaders. To prove that the local neighborhood in (20) converges
to zero, let L be the Laplacian matrix associated with the
entire communication graph including the leaders. Let N and
M specify the number of inverters and all leaders (including
the one legitimate leader and M 1 illegitimate ones). The
leaders have no neighbor and, therefore, can be partitioned as
L1 L2
L . (21)
0M pN M q 0M M
Then, for the observer (20), one has
9 norm pc L1 qnorm c pL2 ql .
where norm and l are the stacked states of the intact
inverters and the leaders, respectively. On the other hand, the
local neighborhood tracking error, (19), can be written as
e L1 norm L2 l .
Taking the derivative of e , and using (22) and (23), one has
e9 c e .
Therefore, e goes to zero. This completes the proof. 
If the communication link from the inverter i to the inverter
j is under a deception attack, then one can assume a virtual
illegitimate leader connected to the inverter j. Therefore, the
local neighborhood tracking error, for inverters not under
attack but afflicted by compromised links, cannot go to zero.
Attacks on communication links are the same as scenar-
ios where an inverter is compromised, except that only the
neighbor reached by the affected communication link receives
corrupted transmission.
B. Observer-based Control with Confidence Factors
A confidence factor is a measure of how much confidence
each inverter has about its own observed frequency set point
depending on whether it is in the path of an attack, and its
proximity to the attack source. The microgrid can be made
more resilient if the immediate neighbors of the infected
inverter detect the attack, and stop it from propagating through
the network. The synchronization of intact inverters are shown
under some connectivity conditions. Define
i ||ei ||
as the norm of the local neighborhood observer tracking error
for inverter i , with ei defined in (20). Based on Theorem 2,
ei and, consequently, i converge to zero, regardless of the
attack status. For the inverter i, define
i aij ||i ptq j ptq|| ` gi ||i ptq ref ||. (26)
jPNi
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Smart Grid
For an inverter reached from an illegitimate leader, i does
not converge to zero but to a steady-state value. Therefore,
even though i converges to zero, i will reach a nonzero
steady-value. In the absence of an attack, all inverters syn-
chronize to the legitimate leader and, therefore, both i and
i go to zero asymptotically. Using (20), one has
pL ` Gq e . (27)
where e reT T T T
1 , e2 , ..., eN s , with ei defined in (20).
T T T T
r1 , 2 , ..., N s with i i ref . Since pL ` Gq is
positive-definite, if e converges to zero asymptotically fast,
the global tracking error also converges to zero asymptoti-
cally fast. On the other hand, assuming that e is the global
state vector, pL ` Gq is a similarity transformation matrix
which gives as the new state vector. Since the similarity
transformation does not change system eigenvalues, in the
absence of an attack, e and and, consequently, i and
i have the same behavior. Thus, comparing i and i can
detect whether the corresponding inverter is reachable from
(22)
an illegitimate leader or not.
The confidence value for an intact inverter i is
C9 i ptq di ptq Ci ptq. (28)
where 0 Ci 1 with
(23)
i
di ptq . (29)
i ` ||i ptq i ptq||
(24) 0 is used to weigh the current data against the past
data, i is a threshold value to consider other factors rather
than attacks. If inverter i is not in the path of any attack, then
||i i || 0 in steady state and, consequently, Ci 1. If
inverter i is effected by an attack, then ||i i || i , and
Ci 1 depending on the proximity of inverter i to the attacked
node. Taking into account the confidence level received from
neighbors, the observer dynamics in (20) become
9 i ptq aij Cj ptq pi ptq j ptqq
jPNi
` gi pi ptq ref q . (30)
C. Observer-based Cooperative Control with Trust Factors
In the trust-incorporated observer-based cooperative control,
each inverter calculates a trust value for each neighbor. If
it drops below a threshold, the intact inverter discards the
neighbors information. Consider the worst-case scenario in
which a compromised inverter always sends the confidence
value of 1 to its neighbors to deceive them. To calculate the
trust level of inverter j for inverter i, the difference between the
observer output of inverter j, and the average of the observer
outputs for all neighbors of inverter i, is calculated as
(25) b9 ij ptq sij ptq bij ptq. (31)
where
i
sij . (32)
1
i ` ||j ptq |Ni | kPNi k ptq||
|Ni | is the number of neighbors of inverter i. 0 weighs
the current data against the past data. i is a threshold value
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
to consider other factors rather than attacks. The trust value
of inverter j for inverter i is defined as
Tij max pCi ptq, bij ptqq .
where 0 Tij 1.
In the absence of an attack, ||j hNi || 0 when
the network is synchronized in steady state, where hNi
1
|Ni | kPNi k and, consequently, Tij 1 @j. When inverter
i receives different observer outputs form its neighbors, i.e.,
||j hNi || is nonzero, Tij 1 @j as Ci is close to one,
since the difference is caused by a change in the leader state.
If inverter i is attacked, then Ci is small, and the trust of
inverter j for inverter i depends on ||j hNi ||. The greater
the difference between j and hNi , the more likely inverter j
is the attack source, or in close proximity to the attack, and
the less credible is its transmitted information. We assume that
the immediate neighbors of the leader always trust the leader.
If the trust value for a neighboring inverter j drops below
a threshold Tij i , then it is identified as a compromised
inverter, and its transmitted information are discarded. This
can happen if inverter j is the attack source or in its close
proximity. The selection of the trust factor is done empirically,
as it would depend on several factors like network connectiv-
ity, speed of convergence of the consensus algorithm and, in
turn, other gains in the consensus algorithm. [18], [33][35]
have used similar thresholds in trust factors. The purpose of
threshold selection is to improve the algorithm performance
by disregarding potentially corrupt data when the trust factor
is low. Taking into account the confidence level received from
neighbors, and the trust values calculated for neighbors, the
observer dynamics in (20) become
9 i ptq aij Cj ptqTij ptq pi ptq j ptqq
jPNi
` gi pi ptq ref q .
The overall observer-based cooperative controller, with trust
factors, is presented in Fig. 2, and detailed in Algorithm 1. A
similar control algorithm can be used for inverter voltages.
Algorithm 1 Secondary control of frequency using observer-
based cooperative control with trust factors at inverter i
Tij 1 and initialize Ci .
for t 0, 1... do
If Tij i , discard j , and set Tij 0
Update i using (34),
Update ui using (18),
Update ni using (11),
Update Ci using (28),
Update Tij using (33),
Transmits i ptq and Ci ptq to neighbors Ni .
end for
Conditions for which the observer outputs for intact invert-
ers synchronize to the leader are discussed.
Assumption 2. (z-local connectivity). The network connec-
tivity is at least p2z ` 1q, i.e., at least half of the neighbors,
for each inverter, are intact [9], [33], where z is the number
of neighbors under attack.
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Smart Grid
Theorem 3. Let Assumption 2 be satisfied. The distributed
observer (34) for intact inverters will synchronize to the leader
state, even with z compromised inverters.
(33)
Proof. If z neighbors of the inverter i are attacked, and they
collude to send the same information to the inverter i, there
still exists z ` 1 intact neighbors that have different values
from the compromised ones. The compromised inverters can
detect the attack and recover from it as long as Assumption
2 is satisfied. There still exists a spanning tree associated
with intact inverters, as the compromised inverters are not
disconnected from the communication graph. It is shown in
[33] that if Tij i 0, and there exists a spanning tree,
then synchronization of intact agents is guaranteed.
If Assumption 2 is violated for the compromised inverter j,
it deceptively trusts most neighbors. However, its immediate
intact neighbors will have small confidence values as they
receive different values from their intact neighbors and the
compromised neighbor j. Therefore, the inverter j will be
isolated by its neighbors to avoid spreading the attack.
VI. C ASE S TUDIES
System Setup: The proposed controller is evaluated for an
islanded microgrid. Figure 3 illustrates a single-line diagram of
a modified IEEE 34-bus balanced test feeder [36] by averaging
the line parameters provided in [36], augmented with six
inverters. The specifications of the inverters connected to the
test feeder are given in the Table I. The load impedances are
load 1 : 1.5 ` j1 , load 2 : 0.5 ` j0.5 , load 3 : 1 ` j1 ,
and load 4 : 0.8 ` j0.8 modeled using (4). The test feeder
is islanded from the main grid at bus 800 at t 0 s. The
inverter specifications are given in the Table I and modeled
using (2) and (3). The nominal frequency and line-to-line
voltage are 60 Hz and 24.9 kV, respectively. The inverters are
(34)
connected to the feeder through Y-Y 480V/24.9 kV, 400 kVA
transformers with a series impedance of 0.03 ` j0.12 p.u.
Each inverter communicates its observer frequency, observer
voltage, confidence factors, and trust factors with its neighbors
through the communication graph (Fig. 3(b)). Inverter 1 is
pinned (receive reference signal) with pinning gain g1 1.
We consider three cases to evaluate the controller performance.
Conventional secondary control is achieved by implementing
(9) and (10) for frequency and equivalent voltage control, as
in [24].
Case A: The attack on sensor/actuator of inverter 2 is
modeled using (12) to produce an output frequency of f2
60.2 Hz at t 1 s. Figures 4(a) and 4(b) show the performance
of the conventional cooperative controller, clearly leading to a
loss of synchrony. Distributed observer-based secondary con-
trol of frequency is achieved by implementing (18) and (19) for
frequency control. Figures 4(c) and 4(d) show the controller
performance with distributed observers. Frequency at all in-
verters, except inverter 2 (under attack), remains synchronized
at f 60 Hz, and voltages of the intact inverters are much
closer (but not synchronized). From Fig. 5(a), it can be seen
that even if the frequency remain synchronized, the voltage
exhibits an oscillatory behavior. This is expected as inverter 2
is operating at a different frequency of f2 60.2Hz. Although
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid

the controller mitigates the attack, the physical interconnection

808 806 802 800
forces the voltages to vary and exhibit the behavior seen. 810 LC Filter Output Connector
Nevertheless, the proposed algorithm provides the only viable (1)

Energy
Source
solution from the distributed control perspective. It can provide 812
time for remedial actions from operator/higher control level,
e.g., disconnecting the inverter under attack (inverter 2). The 814
voltage performance until t 10sec is shown in 5(a) with no Case A
850
mitigating action, and in 5(b) when inverter 2 is disconnected 6 5

at t 5sec. It can be seen that the system performs as desired 816 (2)
once inverter 2 is disconnected. The proposed algorithm, in 818 820 822 1 4

this case, does not completely mitigate the attack as it is a 824

Load 1
physical attack and not cyber, but still performs adequately. 2 3
Case B: The communication link between inverters 2 and 828 826
Case B
3 is corrupted by the false-data injection modeled using (4)
6 5
(13) at t 1 s. Figures 6(a) and 6(b) show the observer- 830 (6)
based distributed controller performance, where inverters lose 852 832 858 864 1 4
854 Load 2
synchrony. This is expected since the distributed observer is
using the compromised communication network. Distributed 842 844
856 834 2 3
observer-based control, with confidence factors in (28), is (3)
achieved by implementing (18) and (30) for frequency control. 860 846 Case C
Figures 6(c) and 6(d) show the same controller performance 838 862
6 5

with confidence factors. Here, intact inverters almost reach (5) 836 848
synchrony. Inverter 3, which receives false information, has 1 4

a large deviation from 60 Hz. Distributed observer-based 840

Load 3
control is achieved by implementing (18) and (34), where 2 3
confidence and trust factors are calculated using (28) and (33), Load 4 (a) (b)
respectively. The implementation of distributed observer-based
secondary control of frequency with trust factors is detailed in Fig. 3. (a) IEEE standard 34-bus feeder system augmented with six inverters;
(b) Topology of the communication network among inverters and attacks
Algorithm 1. Figures 6(e) and 6(f) show the performance of in different cases: Case A-attack on an actuator/sensor, Case B-attack on
the observer-based distributed control with trust factors. The communication links, and Case C-controller compromised.
lower threshold on trust is set at Tij 0.4; once the trust
level of a link drops below this level, it is disconnected from
the graph topology. As seen, all frequency and voltage terms the effect of the attack on other inverters. Figures 7(e) and 7(f)
achieve synchrony. show the performance of the controller with trust factors. The
Case C: The controller at inverter 2 is hijacked modeled us- frequency of all inverters, except the hijacked one, achieve
ing (14) to generate f2 60.2 Hz during t P r1, 2.5s s. Figures synchrony, and voltages of intact inverters are closer. Figure 9
7(a) and 7(b) show the observer-based distributed controller shows the evolution of trust factors over time. Trust factor of
performance where inverters lose synchrony. Figures 7(c) and the link from inverter 2 to inverter 3 decreases significantly,
7(d) show the performance of the controller with confidence and less weight is assigned to the corrupted data from inverter
factors; inverter 2 operates at a different frequency than the 2. Communication link from inverter 2 to inverter 3 is disabled
set point. This shows that confidence-incorporated observer- when trust factor T32 0.4. T32 in Fig. 9 goes back to 1 once
based distributed controller is susceptible to controller hi- the communication link is disabled.
jacking. Figure 8 shows the evolution of confidence factors. Case D: The test feeder is islanded from the main grid
The confidence factor of inverter 3, which is the immediate at bus 800 at t 0 s, and secondary control is applied at
neighbor of compromised inverter 2 decreases significantly, t 1.4 s. The outgoing communication links from inverter
which assigns less weight to data from inverter 3 decreasing 2 and 5 are corrupted by the false-data injected at t 1 s
as shown in Fig.10(a). The lower threshold on trust is set at
TABLE I
Tij 0.4; Once the trust level of a link drops below this level,
I NVERTER S PECIFICATIONS it is disconnected from the graph topology. Figures 11(a) and
11(b) show the performance of the observer-based distributed
Inverters 1,2,4,5 Inverters 3,6 control with trust factors. The inverters lose synchrony; This
Droop mp 5.64 105 mp 7.5 105 is expected as Assumption 2 is not satisfied. Assumption
Gains nq 5.2 104 nq 6 104 2 states that the communication network connectivity is at
Output Rc 0.03 Rc 0.03 least p2z ` 1q, where z is the number of neighbors under
Connector Lc 0.35mH Lc 0.35mH attack. If this Assumption is violated for the compromised
Rf 0.1 Rf 0.1 inverter j, it deceptively trusts its neighbors and microgrid
LC Filter Lf 1.35mH Lf 1.35mH cannot recover. Figure 12(a) shows the evolution of trust
Cf 50F Cf 50F factors over time. In the current network represented by Fig.

1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid

Frequency (Hz) 60.3 1.05

Voltage (pu)
60.2 1

60.1 0.95

60 0.9

(a) 59.9 (b) 0.85

60.3 1.05
Frequency (Hz)

Voltage (pu)
60.2 1

60.1 0.95

60 0.9

(c) 59.9 (d) 0.85

0 1 2 3 4 5 0 1 2 3 4 5
Time (s) Time (s)

Fig. 4. Inverter 2 sensor/actuator attacked with f2 60.2 Hz: (a),(b) Conventional cooperative control; (c),(d) Distributed observer-based cooperative control.

1.2 1.2

Voltage (pu)
Voltage (pu)

1.1 1.1

1 1

0.9 0.9
(a) (b)
0 2 4 6 8 10 0 2 4 6 8 10
Time (s) Time (s)

Fig. 5. Inverter 2 sensor/actuator attacked with f2 60.2 Hz: (a) Distributed observer-based cooperative control; (b) Distributed observer-based cooperative
control with inverter 2 taken offline at t 5 s.

60.2 1.05
Frequency (Hz)

Voltage (pu)

60.15
1
60.1
60.05 0.95
60
0.9
59.95
(a) 59.9 (b) 0.85
60.2 1.05
Frequency (Hz)

60.15
Voltage (pu)

1
60.1
60.05 0.95
60
0.9
59.95
59.9
(c) (d) 0.85
60.1 1.05
Frequency (Hz)

Voltage (pu)

60.05 1

60 0.95

59.95 0.9

(e) 59.9 (f) 0.85

0 1 2 3 4 5 0 1 2 3 4 5
Time (s) Time (s)

Fig. 6. The outgoing communication link from inverter 2 is attacked with f2 60.2 Hz: (a),(b) Distributed observer-based cooperative control; (c),(d)
Distributed observer-based cooperative control with confidence factors; (e),(f) Distributed observer-based cooperative control with trust factor.

10(a), inverter 6 is only receiving information from inverters 5 and 1, that does not satisfy the assumption. Figures 11(c)

1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid

Frequency (Hz) 60.3 1.05

Voltage (pu)
60.2 1

60.1 0.95

60 0.9

(a) 59.9 (b) 0.85

60.3 1.05
Frequency (Hz)

Voltage (pu)
60.2 1

60.1 0.95

60 0.9

59.9 0.85
(c) (d)
60.3 1.05
Frequency (Hz)

Voltage (pu)
60.2 1

60.1 0.95

60 0.9

(e) 59.9 (f) 0.85

0 1 2 3 4 5 0 1 2 3 4 5
Time (s) Time (s)

Fig. 7. Inverter 2 controller is compromised between t 1 s and t 2.5 s with f2 60.2 Hz: (a),(b) Distributed observer-based cooperative control;
(c),(d) Distributed observer-based cooperative control with confidence factors; (e),(f) Distributed observer-based cooperative control with trust factor.

1.2
Confidence Value

1
6 5 6 5
0.8
0.6
1 4 1 4
0.4
0.2
0 2 3 2 3
0 1 2 3 4 5
(a) (b)
Time (s)

Fig. 8. Confidence levels, Ci , when the inverter 2 controller is compromised Fig. 10. Topology of the communication network among inverters during
between t 1 s and t 2.5 s, with f2 60.2 Hz. multiple attacks on communication links: (a) Network with assumption 2
p2z ` 1q not satisfied at inverter 6; (b) Network with assumption 2 p2z ` 1q
satisfied (Communication link between inverter 3 and inverter 6 is made
1.2 bidirectional).

0.8 frequency and voltage terms achieve synchrony, that ascertains

Trust Value

the importance of network connectivity conditions. Figure

0.6 12(b) shows the evolution of trust factors over time. Trust
0.4 factors of links from inverter 2 to inverter 3, and from inverter
5 to inverter 6, decreases, as less weight is assigned to the
0.2 corrupted data from inverters 2 and 5.
Link Deactivated
0
0 1 2 3 4 5 VII. C ONCLUSION
Time (s)
Attack-resilient distributed synchronization of inverter-
Fig. 9. Trust levels when the inverter 2 is compromised between t 1 s based networked AC microgrids is addressed. The vulner-
and t 2.5 s, with f2 60.2Hz, using a distributed observer with trust ability of the standard cooperative control to attacks on
factors. Tij is the trust level associated to the link from inverter j to i.
sensor/actuator and communication links, and controller hi-
jacking, is shown. A distributed observer-based cooperative
controller is presented to address sensors/actuators attacks. It
and 11(d) show the same controller performance with trust is then augmented with confidence and trust factors to make
factors when a modified communication network shown in the microgrid more resilient to attacks on communication
Fig.10(b), that satisfies Assumption 2, is used. As seen, all links and hijacking controllers. The resilience of the proposed

1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid

10

Frequency (Hz) 1.05

60.2

Voltage (pu)
60.1 1

60 0.95
59.9
0.9
59.8
(a) (b) 0.85
1.05
Frequency (Hz)

60.2

Voltage (pu)
60.1 1

60 0.95
59.9 0.9
59.8
(c) (d) 0.85
0 1 2 3 4 5 0 1 2 3 4 5
Time (s) Time (s)

Fig. 11. The outgoing communication links from inverter 2 and 5 are attacked with f2 60.2 Hz: (a),(b) Distributed observer-based cooperative control
with trust factors using communication topology in Fig. 10(a); (c),(d) Distributed observer-based cooperative control with trust factor using communication
topology in Fig. 10(b).

1.2 1.2

1 1

0.8 0.8
Trust Value

Trust Value

0.6 0.6

0.4 0.4

0.2 0.2

0 0
0 1 2 3 4 5 0 1 2 3 4 5
(a) Time (s) (b) Time (s)

Fig. 12. Trust levels when the outgoing communication links from inverter 2 and 5 are attacked with f2 60.2 Hz, using distributed observers with trust
factors: (a) Using communication topology in Fig. 10(a); (b) Using communication topology in Fig. 10(b).

control techniques is evaluated for a modified 34-bus IEEE
feeder system for different types of attacks.
R EFERENCES
[1] A. Bidram, A. Davoudi, F. Lewis, and J. Guerrero, Distributed coop-
erative secondary control of microgrids using feedback linearization,
IEEE Trans. Power Syst., vol. 28, no. 3, pp. 34623470, Aug 2013.
[2] J. Simpson-Porco, Q. Shafiee, F. Dorfler, J. Vasquez, J. Guerrero, and
F. Bullo, Secondary frequency and voltage control of islanded micro-
grids via distributed averaging, IEEE Trans. Ind. Electron., vol. 62,
no. 11, pp. 70257038, Nov 2015.
[3] J. Schiffer, T. Seel, J. Raisch, and T. Sezi, Voltage stability and
reactive power sharing in inverter-based microgrids with consensus-
based distributed voltage control, IEEE Trans. Control Syst. Technol.,
vol. 24, no. 1, pp. 96109, Jan 2016.
[4] F. Guo, C. Wen, J. Mao, J. Chen, and Y.-D. Song, Distributed
cooperative secondary control for voltage unbalance compensation in
an islanded microgrid, IEEE Trans. Ind. Informat., vol. 11, no. 5, pp.
10781088, Oct 2015.
[5] M. Tahir and S. Mazumder, Self-triggered communication enabled
control of distributed generation in microgrids, IEEE Trans. Ind.
Informat., vol. 11, no. 2, pp. 441449, April 2015.
[6] J. Slay and M. Miller, Lessons Learned from the Maroochy Water
Breach. Boston, MA: Springer US, 2008, pp. 7382.
[7] J. P. Farwell and R. Rohozinski, Stuxnet and the future of cyber war,
Survival, vol. 53, no. 1, pp. 2340, 2011.
[8] F. Pasqualetti, A. Bicchi, and F. Bullo, Consensus computation in
unreliable networks: A system theoretic approach, IEEE Trans. Autom.
Control, vol. 57, no. 1, pp. 90104, Jan 2012.
[9] F. Pasqualetti, F. Dorfler, and F. Bullo, Attack detection and identifica-
tion in cyber-physical systems, IEEE Trans. Autom. Control, vol. 58,
no. 11, pp. 27152729, Nov 2013.
[10] K. Manandhar, X. Cao, F. Hu, and Y. Liu, Detection of faults and
attacks including false data injection attack in smart grid using kalman
filter, IEEE Trans. Control Netw. Syst., vol. 1, no. 4, pp. 370379, Dec
2014.
[11] Y. Huang, J. Tang, Y. Cheng, H. Li, K. A. Campbell, and Z. Han, Real-
time detection of false data injection in smart grid networks: An adaptive
cusum method and analysis, IEEE Syst. J., vol. 10, no. 2, pp. 532543,
June 2016.
[12] S. Bi and Y. J. Zhang, Graphical methods for defense against false-data
injection attacks on power system state estimation, IEEE Trans. Smart
Grid, vol. 5, no. 3, pp. 12161227, May 2014.
[13] L. Liu, M. Esmalifalak, Q. Ding, V. A. Emesih, and Z. Han, Detecting
false data injection attacks on power grid by sparse optimization, IEEE
Trans. Smart Grid, vol. 5, no. 2, pp. 612621, March 2014.
[14] Y. Mo, R. Chabukswar, and B. Sinopoli, Detecting integrity attacks on
scada systems, IEEE Trans. Control Syst. Technol., vol. 22, no. 4, pp.
13961407, July 2014.
[15] T. Alpcan and T. Basar, A game theoretic approach to decision and
analysis in network intrusion detection, in Proc. 42nd IEEE Conference
on Decision and Control, vol. 3, Dec 2003, pp. 25952600.
[16] P. Srikantha and D. Kundur, A der attack-mitigation differential game

1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
for smart grid security analysis, IEEE Trans. Smart Grid, vol. 7, no. 3,
pp. 14761485, May 2016.
[17] H. Fawzi, P. Tabuada, and S. Diggavi, Secure estimation and control for
cyber-physical systems under adversarial attacks, IEEE Trans. Autom.
Control, vol. 59, no. 6, pp. 14541467, June 2014.
[18] Y. Liu, H. Xin, Z. Qu, and D. Gan, An attack-resilient cooperative con-
trol strategy of multiple distributed generators in distribution networks,
IEEE Trans. on Smart Grid, vol. 7, no. 6, pp. 29232932, Nov 2016.
[19] M. Basseville, I. V. Nikiforov et al., Detection of abrupt changes: theory
and application. Prentice Hall Englewood Cliffs, 1993, vol. 104.
[20] Q. Jiao, H. Modares, F. L. Lewis, S. Xu, and L. Xie, Distributed l2 -gain
output-feedback control of homogeneous and heterogeneous systems,
Automatica, vol. 71, pp. 361 368, 2016.
[21] S. Abhinav, I. Schizas, F. Lewis, and A. Davoudi, Distributed noise-
resilient networked synchrony of active distribution systems, IEEE
Trans. Smart Grid, 2016, to be published.
[22] R. Olfati-Saber and R. Murray, Consensus problems in networks of
agents with switching topology and time-delays, IEEE Trans. Autom.
Control, vol. 49, no. 9, pp. 15201533, Sept 2004.
[23] A. Bidram, F. Lewis, and A. Davoudi, Distributed control systems
for small-scale power networks: Using multiagent cooperative control
theory, IEEE Control Syst., vol. 34, no. 6, pp. 5677, Dec 2014.
[24] A. Bidram, A. Davoudi, F. Lewis, and Z. Qu, Secondary control
of microgrids based on distributed cooperative control of multi-agent
systems, IET Gener. Transmiss. Distrib., vol. 7, no. 8, pp. 822831,
Aug 2013.
[25] V. Nasirian, Q. Shafiee, J. M. Guerrero, F. L. Lewis, and A. Davoudi,
Droop-free distributed control for ac microgrids, IEEE Trans. Power
Electron., vol. 31, no. 2, pp. 16001617, Feb 2016.
[26] Q. Shafiee, V. Nasirian, J. C. Vasquez, J. M. Guerrero, and A. Davoudi,
A multi-functional fully distributed control framework for ac micro-
grids, IEEE Trans. Smart Grid, 2016, to be published.
[27] Q. Shafiee, C. Stefanovic, T. Dragicevic, P. Popovski, J. C. Vasquez,
and J. M. Guerrero, Robust networked control scheme for distributed
secondary control of islanded microgrids, IEEE Trans. Ind. Electron.,
vol. 61, no. 10, pp. 53635374, Oct 2014.
[28] Q. Shafiee, J. M. Guerrero, and J. C. Vasquez, Distributed secondary
control for islanded microgrids: A novel approach, IEEE Trans. Power
Electron., vol. 29, no. 2, pp. 10181031, Feb 2014.
[29] S. Amin, G. A. Schwartz, and S. S. Sastry, Security of interdependent
and identical networked control systems, Automatica, vol. 49, no. 1,
pp. 186 192, 2013.
[30] X. Liu and Z. Li, Local load redistribution attacks in power systems
with incomplete network information, IEEE Trans. Smart Grid, vol. 5,
no. 4, pp. 16651676, July 2014.
[31] , False data attacks against ac state estimation with incomplete
network information, IEEE Trans. Smart Grid, 2016, to be published.
[32] Z. Li, W. Ren, X. Liu, and M. Fu, Distributed containment control
of multi-agent systems with general linear dynamics in the presence
of multiple leaders, International Journal of Robust and Nonlinear
Control, vol. 23, no. 5, pp. 534547, 2013.
[33] H. J. LeBlanc, H. Zhang, X. Koutsoukos, and S. Sundaram, Resilient
asymptotic consensus in robust networks, IEEE J. Sel. Areas Commun.,
vol. 31, no. 4, pp. 766781, April 2013.
[34] J. Duan, W. Zeng, and M. Y. Chow, Resilient distributed dc optimal
power flow against data integrity attack, IEEE Trans. Smart Grid, 2016,
to be published.
[35] W. Zeng and M. Y. Chow, Resilient distributed control in the presence
of misbehaving agents in networked control systems, IEEE Trans.
Cybern., vol. 44, no. 11, pp. 20382049, Nov 2014.
[36] N. Mwakabuta and A. Sekar, Comparative study of the IEEE 34 node
test feeder under practical simplifications, in Proc. 39th North Amer.
Power Symp., Las Cruces, NM, USA, 2007, pp. 484491.
Shankar Abhinav (GS13) received the B.E. de-
gree in Electrical and Electronics Engineering from
Visvesvaraya Technological University, Karnataka,
India, in 2011. He is currently working toward the
Ph.D. degree at the University of Texas at Arling-
ton, USA. His research interests include modeling
and control of power electronics, microgrid control,
distributed control systems, and renewable energy
resources.
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
11
Hamidreza Modares (M15) received the B.S. de-
gree from the University of Tehran, Tehran, Iran,
in 2004, the M.S. degree from the Shahrood Uni-
versity of Technology, Shahrood, Iran, in 2006, and
the Ph.D. degree from The University of Texas
at Arlington, Arlington, TX, USA, in 2015, all in
electrical engineering. He was a Senior Lecturer
with the Shahrood University of Technology, from
2006 to 2009, and a Faculty Research Associate
with the University of Texas at Arlington, from 2015
to 2016. He is currently an Assistant Professor in
the Electrical and Computer Engineering Department, Missouri University
of Science and Technology, Rolla, MO, USA. His current research interests
include cyber-physical systems, reinforcement learning, distributed control,
robotics, and machine learning. Dr. Modares is an Associate Editor for the
IEEE TRANSACTIONS ON NEURAL NETWORKS AND LEARNING
SYSTEMS. He has received best paper award from the 2015 IEEE Inter-
national Symposium on Resilient Control Systems.
Frank L. Lewis (S78-M81-SM86-F94) received
the B.S. degree in physics/electrical engineering and
the M.S.E.E. degree from Rice University, Houston,
TX, USA, the M.S. degree in aeronautical engineer-
ing from the University of West Florida, Pensacola,
FL, USA, and the Ph.D. degree from Georgia In-
stitute of Technology, Atlanta, GA, USA. He is a
member of the National Academy of Inventors. He
is a Fellow of the International Federation of Auto-
matic control, the U.K. Institute of Measurement and
Control, and a Professional Engineer at Texas. He is
Moncrief-ODonnell Chair at the University of Texas at Arlington Research
Institute as well as Qian Ren Thousand Talents Consulting Professor, North-
eastern University, Shenyang, China. He is Distinguished Visiting Professor
at Nanjing University of Science and Technology and Project 111 Professor
at Northeastern University in Shenyang, China.
He works in feedback control, intelligent systems, cooperative control
systems, and nonlinear systems. He is author of 7 U.S. patents, numerous
journal special issues, journal papers, and 20 books. He received the Fulbright
Research Award, NSF Research Initiation Grant, ASEE Terman Award, Int.
Neural Network Soc. Gabor Award, U.K. Inst Measurement and Control Hon-
eywell Field Engineering Medal, IEEE Computational Intelligence Society
Neural Networks Pioneer Award, AIAA Intelligent Systems Award, and the
Texas Regents Outstanding Teaching Award.
Frank Ferrese (SM17) is a lead research engineer
at Naval Surface Warfare Center, Philadelphia. He
has a BS in Drexel University in Electrical Engi-
neering (1995), and an MS (2006) and PhD (2013) in
Engineering from Villanova University. His research
interests include control theory and optimization
theory.
Ali Davoudi (S04-M11-SM15) received his Ph.D.
in Electrical and Computer Engineering from the
University of Illinois, Urbana-Champaign, IL, USA,
in 2010. He is currently an Associate Professor
in the Electrical Engineering Department, Univer-
sity of Texas, Arlington, TX, USA. He is an
Associate Editor for the IEEE TRANSACTIONS
ON TRANSPORTATION ELECTRIFICATION, the
IEEE TRANSACTIONS ON ENERGY CONVER-
SION, and the IEEE POWER LETTERS. He has
received 2014 Ralph H. Lee Prize paper award from
IEEE Transactions on Industry Applications, best paper award from 2015
IEEE International Symposium on Resilient Control Systems, 2014-2015 best
paper award from IEEE Transactions on Energy Conversion, and 2016 Prize
Paper Award from the IEEE Power and Energy Society, and 2017 IEEE
Richard M. Bass Outstanding Young Power Electronics Engineer Award.